Your service would have to sign the double spend transaction which means it would be a hot wallet. So either you are turning your cold storage into a hot wallet...
Or you could get around this by presigning a transaction for every single one of your utxos, and then just have the service select which one is required, but then you have to guess what a high enough fee rate would be long before you actually need to get the transaction confirmed.
FYI: The second ("or") part is what a watchtower in the lightning network does.
reply
And in the case of theft, you have to deal with out of band payment via one of the transaction accelerator services offered by miners.
You might not even know how much a miner will get paid to mine it and so it could be very difficult to find a high enough rate for rbf or cpfp.
If anti theft is the use case, you should probably assume that the thief is taking the transaction directly to a miner and skipping mempool propagation altogether.
reply